PT-2007-6606 · Unknown · Xscreensaver+1

Published 2007-10-19 · Updated 2008-09-05 · CVE-2007-5585

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions xscreensaver versions 5.03 and earlier

Description The issue occurs when xscreensaver is running without xscreensaver-gl-extras installed. If the /usr/bin/xscreensaver-gl-helper file does not exist and a user attempts to unlock the screen, xscreensaver crashes. This crash allows attackers with physical access to gain access to the locked session.

Recommendations For xscreensaver versions 5.03 and earlier, consider installing xscreensaver-gl-extras to mitigate the risk of exploitation. As a temporary workaround, ensure the /usr/bin/xscreensaver-gl-helper file exists to prevent the crash.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2007-5585

DTSA-83-1

Affected Products

Xscreensaver

Xscreensaver-Gl-Extras

References · 8

• https://redhat.com/archives/fedora-package-announce/2007-October/msg00336.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-5585 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-5585 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-5585 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-5585 · Vendor Advisory
• http://securityfocus.com/bid/26204 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=336331 · Note
• http://secunia.com/advisories/27392 · Note